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MAIL STOP AF 

Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

Sir: 

Further to the Notice of Appeal filed herewith, and prior to the filing of an Appeal Brief, 
Applicant respectfully requests review of the following rejections: 

• Claims 1-16 under 35 U.S.C. § 103(a) as being unpatentable over Allison et al. 
(WO 200271234 A) ("Allison") in view of Gould et al. (U.S. 2004/0199592 Al) 
("Gould") and further in view of Wolczko et al. (U.S. 6,728,738, "Wolczko"). 
The claims pending in the present application are directed to a method for detecting an 
undesirable condition within a messaging network. For example, claim 1 recites a method that 



receiving a message from a source; 

incrementing a source counter and updating an array of 
timestamps with a new entry corresponding to a time at which the 
message from the source was received, the array of timestamps 
including a timestamp entry for each respective source counter 
increment, and further including more than two timestamps for 
a given source; 



includes: 
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iterating through the array of timestamps to access all 
source counters and associated timestamps; 

removing entries in the array of timestamps that are older 
than a fixed window size, and decrementing the source counter 
for each entry so removed; 

comparing the source counter to a source threshold; and 

when the source counter exceeds the source threshold, 
triggering an alarm indicative of an undesirable condition. 

Thus, the timestamp array that is filled as source address counters are incremented 
include multiple entries for each source address (" wherein the array of timestamps includes more 
than two timestamps for a given source address "). It is acknowledged in the paragraph bridging 
pages 3 and 4 of the Office Action that neither Allison nor Gould teaches an array of timestamps 
including more than two timestamps for a given source, or iterating through the array to remove 
entries therein. For these aspects of the claimed invention the Office Action cites to Wolczko. 

Wolckzo discloses a method for "lifetime analysis" of objects in a garbage-collected 
system, wherein "reference counts" are maintained for each object in an object graph. Reference 
counts are stored values that indicate the number of incoming pointers to a given object. 
Wolckzo at col. 3, lines 40-43 and Figs. 2 and 3. Fig. 3 of Wolckzo illustrates a problem in 
which even though the reference counts of objects 302, 304 and 306 in cycle 300 are all non- 
zero, those objects may nevertheless be dead as none of the objects in the cycle is, in fact, 
reachable from a root. Wolckzo at col. 3, lines 59-65. To identify the dead objects in such a 
cycle, Wolckzo discloses using a "tracing collector," such as mark-sweep collector, "to detect 
when objects are cyclic garbage." Wolckzo at col. 4, lines 56-59. Then, to figure out precisely 
when a cycle (and objects therein) actually died, timestamps of changes to the cycles are 
examined in reverse chronological order. Wolckzo at col. 4, lines 1-5. The lifetime of a given 
object may then be determined based on the time it was created and the time it dies. Wolckzo at 
col. 4, line 67 to col. 5, line 5. 

Thus, in Wolckzo, the timestamp values have to do with when an object is pointed to. 

Notably, the reference count in Wolckzo does not keep track of which other object pointed to a 

given object. In other words, Wolckzo does not track a source. Consequently, Wolckzo does not 
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disclose an array of timestamps having "more than two timestamps for a given source ," as is 
required by the claims, since Wolckzo does not have any idea what source (other object) has 
caused the reference count to be incremented. More importantly, there is only one pointer from 
any given object to another given object. That is, there is never more than one source 
attributable to a counter increment in Wolckzo. Consequently, Wolckzo does not overcome the 
deficiencies of Allison and Gould. 

Furthermore, and contrary to the assertion made in the Office Action, Gould does not 
disclose decrementing a source counter when entries in the array of timestamps are removed, as 
required by the claims. Gould only discloses incrementing a message counter. See, e.g., 
paragraph [0046] of Gould. If the message rate calculated in Gould is above a threshold, then 
"remedial action" is taken, including, e.g., discarding or blocking emails or delaying emails. 
See, e.g., paragraph [0049] of Gould. However, there is no disclosure regarding decrementing 
the message counter as a result of any of those actions. Accordingly, Gould does not disclose a 
required element of the claims. 

Because, for the reasons outline above, none of Allison, Gould or Wolckzo discloses or 
suggests expressly recited limitations of the claims, the §103 rejection of the claims based on 
those prior art references must be withdrawn. 
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